teesloane / auth-boss Goto Github PK

The Zine is available at this link for free: gum.co/webauthzine
If I can add this to the repo, it will be a great match for content with visual representations as well. I would like to know your thoughts.

My team at work we were able to enter the local machine to the Active Directory domain that checks the user login and password for the Kerberos protocol. The application works in a browser.

Hey,

I think there's a bit of confusion between identification, authentication and authorization and it could be good to clear that. This could help to define the three terms.

The principal issue is the description of OAuth2: it's about authorization, not authentication (as is OpenID and the other methods). Facebook, Google and others keep their own identification/authentication system and, as a user, you still have to authenticate yourself to them. OAuth2 will then authorize (as you've requested) the other site to use some of your data (email address, name, maybe more; it could be defined in the scope). To do so, it must identify you to the site (so you could indeed use it as an identification protocol) but it's not why it has been designed. This StackOverflow topic surely explains it better.

It could also be dangerous to use OAuth2 as an identification protocol (even if Google and Facebook use it that way). This answer on StackExchange and the OAuth2 RFC explain why.

Weirdly, the Authorization header is about authentication (I don't understand the name choice).

Good job, though 👍
Quentin

OAuth docs clearly state:

"OAuth 2.0 is not an authentication protocol."

Here: https://oauth.net/articles/authentication/

So perhaps it would be better for you to change the text to "OAuth is an authorization protocol" and then perhaps link to the above document for the sake of pedants.

It's pretty standard to have base64 encoding for JWT secrets, but that's a confusing part for a lot of people, especially those who would be consuming a JWT that is generated by Auth0.

For example, I need to specifically create a Base64 encoded string to Authenticate the JWT on my app:

export function verifyToken(token) {
  return new Promise((resolve, reject) => {
    jwt.verify(
      token,
      new Buffer(process.env.AUTH0_CLIENT_SECRET, 'base64'),
      { audience: process.env.AUTH0_CLIENT_ID, },
      (err, decoded) => {
        if (err) reject(new Error('Could not verify JWT'))
        resolve(decoded)
      })
  })
}

Had I not done that part, the token would have never properly authenticated.